Extracted

• • Target

    1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe

  • Size

    560KB

  • MD5

    0c84a5727488a29d79506aad7b9e8fca

  • SHA1

    71bb901c18f2c9cf8514e9bfb9c9462398ad30c6

  • SHA256

    1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681

  • SHA512

    82fecbd6eaa17ce089bdd851272ff254114b28e37c46cb565f05d5868fa956221a558c68482cc2fccd43dfdf4c2b2244e6801009b36f086b1e1718f78b9c5888

  • SSDEEP

    12288:1bQNl/WqCYWjgAXty1e6AhQn/rXuoW+sr6RfO12K8Q0:1bmbWjgktYnzvdKcI2K8Q0

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2